CVE-2026-109258: imagemagick imagemagick

CVSS 7.5 (high) · published 2026-10-12

ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX runtime entry fails. Attackers can trigger the failed FX runtime initialization to cause an invalid free, resulting in memory corruption and application crashes.

Affected products (NVD): imagemagick imagemagick

Fixed in (NVD): 7.1.2-32

Weakness: CWE-476

Source: NVD CVE-2026-109258

References

• https://github.com/ImageMagick/ImageMagick/commit/8caa6a0c62a3ac1f81b19a2ee929fbfe46ee0323
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-pv8x-gq6w-gp4r
• https://www.vulncheck.com/advisories/imagemagick-7.1.0-20-before-7.1.2-32-invalid-memory-free-in-fx-operation

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.